Integrating Vulnerability Scanning into the SDLC Eric Johnson JavaOne Conference 10/26/2015 1
Eric Johnson (@emjohn20) Senior Security Consultant Certified SANS Instructor Certifications CISSP, GWAPT, GSSP- Java, GSSP-.NET Contact Info eric.johnson@cypressdefense.com 2
Agenda Case Study Secure Development Lifecycle Continuous Integration Continuous Delivery Demo Questions 3
Case Study #1 Company A provides a video sharing service Over 1 billion users per month 4
Case Study #1 Client- side AJAX request Web service endpoint deletes any event with a valid session token: POST https://companya.com/live_events_edit_status_ajax? action_delete_live_event=1 event_id: ANY_EVENT_ID session_token: SESSION_TOKEN 5
Case Study #1 YouTube Bug bounty program paid $5,000 I fought the urge to clean up Justin Bieber's channel - Kamil Hismatullin 6
Case Study #2 Company B Social media web site with over 380 million users 7
Case Study #2 Company B has a request vulnerable to SQL injection Example request: POST https://companyb.com/search searchterm= OR 1=1; UPDATE Users SET IsAdmin = 1 WHERE UserName = Milton ; -- 8
Case Study #2 An automated SQL injection tool (sqlmap) is used to extract the database User table contains 6.5 million password hashes Investigation reveals SHA1 hashes are unsalted 9
Case Study #2 LinkedIn 4 million SHA1 hashes reversed The enhanced security we just recently put in place includes hashing and salting of our current password databases. We sincerely apologize for the inconvenience this has caused our members. Vincent Silveira, LinkedIn 10
And the list goes on.. 11
The Root Cause Silos / politics between enterprise groups Leaving security until the very end Legacy applications Fear of breaking production code Slow deployment cycles leave vulnerability windows open 12
Securing the Development Lifecycle Security is baked into all phases of development * Gary McGraw Touchpoint Model 13
Meet Your Security Team Security is everyone s job: Developers Quality Assurance Operations Security Team Management C- Level Executives 14
Iteration Zero Assign a security expert to the project team Define the security requirements Privacy assessment Attack surface analysis Threat modeling 15
Security Testing in Development Percentage of development teams performing security testing: 21.6% Perform Security Testing 78.4% Not Security Testing *2015 SANS Application Security Survey 16
The Sprint Agile & DevOps move too fast for traditional security processes Security must adapt using incremental / automated testing Continuous Integration Continuous Delivery 17
Continuous Integration Check- in triggers automated tests Provides fast feedback to developers (minutes) Security has a limited role: Security- specific unit testing Authentication, user management, password, access control, validation Developer driven static / dynamic analysis Dangerous function calls, OWASP Top 10 Rules sets must produce very few false positives 18
Continuous Integration Tools Jenkins Static Analysis Plugins Find Security Bugs, Checkstlye, OWASP Dependency Check Find Security Bugs Eclipse Security Testing Plug- in 19
Find Security Bugs Written by Philippe Arteau (@h3xstream) FindBugs plug- in with 67 security- specific rules OWASP TOP 10, SANS CWE Top 25 http://h3xstream.github.io/find- sec- bugs/ WebGoat Scan 15 security issues found out of the box 101 security issues found with FSB installed 20
Eclipse Security Testing Plug- in Written by Gregory Leonard (@appsecgreg) [CON5653] Managing 3 rd Party Security Risks Wednesday @ 3:00 PM Integrates dynamic scanning into the IDE Currently supports: ZED Attack Proxy (ZAP) spider and active scan 21
Continuous Delivery Code changes are pushed into the automated deployment pipeline (test, staging, prod) Required security checkpoints: Automated dynamic testing Deep static analysis Pass / fail criteria determine if the build fails 22
Continuous Delivery Frameworks Security- specific testing: Yahoo Gryffin https://github.com/yahoo/gryffin http://bit.ly/1lqqlgj Mozilla Minion https://wiki.mozilla.org/security/projects/minion Gauntlt http://gauntlt.org/ 23
The Sprint Retrospective Security issues # of security issues identified vs. # remediated? Schedule external assessments Security- specific source code reviews Penetration testing Feed security issues to the backlog / defect tracking systems If needed, scheduled a hardening sprint 24
The Benefits Scans occurs as code is written Consistent and repeatable process Incremental security testing Release more secure code to production 25
Demo! Demo! Demo! Find Security Bugs Eclipse Security Testing 26
Future enhancements: Add to Eclipse Marketplace Additional IDE / build support Visual Studio, Maven, Ant, TFS Provide additional scanner support Burp Suite, w3af, Arachni Limitations Eclipse Dynamic Security Testing ZAP REST API (session state not enabled) 27
Thanks for attending! Questions? Contact Info Twitter: @emjohn20 Email: eric.johnson@cypressdefense.com 28